Why companies switch
Let's be honest: most companies don't actively think about their certification body. You once made a choice, and since then the contract has been automatically extended. But is that smart?
Research shows that companies switch for various reasons:
- The audit yields too little. You get a certificate, but no real insights that will help your company further.
- The auditor lacks industry knowledge. A generic approach does not work if your sector has specific challenges.
- The service is inadequate. Poor accessibility, inflexible planning, slow communication.
- The price is no longer correct. Rates have risen, or you have discovered that it can be cheaper elsewhere.
- You want to consolidate. Multiple certificates from different parties is inconvenient.
Internationally, it is even common to change certification bodies every five to ten years. Not out of dissatisfaction, but because a fresh look reveals new areas for improvement. This prevents tunnel vision.
The success of an audit depends on the auditor. Certification remains a human job. If the click is not there, you can be critical of it.
The international rules: IAF MD 2
You may be thinking: "But can I just switch? And what will happen to my certificate?"
Good questions. And the answer is reassuring.
Switching certification bodies is regulated in an international document: IAF MD 2. These are the rules that all accredited certification bodies must adhere to. The most important points at a glance:
Your certificate remains valid
No interruption during or after the transfer. Your new certification body will take over the certification within your existing cycle.
Your old CI should not be a hindrance
They are not allowed to revoke your certificate because you switch. Cooperation with the transfer is mandatory.
Your audit cycle continues
No extra audits, no duplication of work. The new certification body builds on your existing audit history.
Available at any time
You don't have to wait for your certificate to expire. Please note the notice period of your current contract (usually 4-8 weeks).
How the switch works
The practice is less complicated than you might expect. This is what happens:
The pre-transfer review
Your new certification body first looks at your file. They check your latest audit reports, any outstanding deviations and complaint history. This is called the "pre-transfer review" and is not an audit, but an administrative check.
At most companies this is a formality that can be arranged within a few days. You give permission for your current certification body to share the information, and the new party to assess whether everything is in order.
What you need
For a smooth transition, collect these documents:
- Copy of your current certificate (with expiration date)
- Audit reports from the last three years
- Status of any outstanding deviations
- Overview of complaints and how they were handled
That's it. Your new certification body will take care of the rest.
The timeline
On average, the switching process takes two to four weeks from the moment you choose a new certification body. This depends on the availability of the new auditor and how quickly the documentation is transferred.
When does switching make sense for you?
Not everyone has to switch. But it is smart to regularly evaluate whether your current situation is still suitable. Ask yourself these questions:
- Does the audit provide you with anything? Do you gain useful insights, or does it feel like an obligatory number?
- Does your auditor understand your industry? Or do you have to explain how your sector works every year?
- What is the service like? Are you satisfied with the communication, planning and accessibility?
- Is the price still correct? Have you compared with other providers in recent years?
- Does the approach suit your company? Some certification bodies are formal and process-oriented, others personal and pragmatic.
If you answer "no" or "don't know" to several questions, it might be time to compare.
Choosing an ISO 27001 Certification body
There are more than 25 certification bodies active in the Netherlands for ISO 27001. They differ in price, approach and specialisation. How do you choose the right one?
Five criteria to pay attention to
Accreditation
Non-accredited certificates are often not recognised
Industry experience
An auditor who understands IT and security adds more value
Price
Differences of 20-40% are normal
Service
Permanent contact person? Quick responses? Flexibility?
Working relationship with the auditor
You will work together for at least three years
What is accreditation?
Accreditation bodies audit certification bodies. They check whether auditors are qualified for ISO 27001, whether the certification body works independently, and whether the audit is carried out correctly.
Each country has its own authority: the Dutch accreditation body, UKAS in the United Kingdom, DAkkS in Germany. They recognise each other's certificates through the IAF (International Accreditation Forum). A certificate from a UKAS-accredited certification body is therefore just as valid as one from an Dutch-accredited one.
Questions to ask
Before you choose, ask potential certification bodies these questions:
- Are you accredited for ISO 27001? At which agency?
- What is your experience in my sector (IT, finance, healthcare)?
- Does the auditor have experience with our technology (cloud, development, specific systems)?
- Who will be my auditor? Can I speak to that person in advance?
- What is the lead time from quotation to certificate?
- What are the total costs for three years (including surveillance)?
- How do you deal with deviations during the audit?
The right choice is not necessarily the cheapest. An auditor who understands your IT environment and provides constructive feedback is worth more than a few hundred euros in savings.
Ready to compare? View our overview of certification bodies in the Netherlands and find one that fits your company.